CVE-2026-66399 Overview
CVE-2026-66399 is a privilege escalation vulnerability in phpMyFAQ versions before 4.1.6. The flaw resides in the GroupController::updateMembers() method, which fails to verify whether an administrator holds the rights associated with a target group before adding members. Administrators with only group-management permissions can add themselves to privileged groups and inherit rights such as user management. Attackers who obtain these inherited permissions can then modify or delete arbitrary user accounts within the application [CWE-269].
Critical Impact
A low-privileged administrator can escalate to full user-management control, enabling account takeover and deletion of other administrators.
Affected Products
- phpMyFAQ versions prior to 4.1.6
- Deployments exposing the administrative group management interface
- Multi-tenant installations relying on granular role separation
Discovery Timeline
- 2026-07-27 - CVE-2026-66399 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-66399
Vulnerability Analysis
phpMyFAQ implements role-based access control by assigning users to groups that carry specific rights such as edit_user, delete_user, or add_user. Administrators with the add_group or group-management right are expected to manage group membership but not to grant themselves rights they do not already possess. The GroupController::updateMembers() endpoint updates group membership without checking whether the requesting administrator holds the rights associated with the target group.
As a result, an administrator limited to group management can add their own account, or any account they control, to a group that already possesses user-management privileges. Once added, the account immediately inherits those rights on subsequent requests. The attacker can then delete or modify other administrator accounts, including accounts with rights they were never explicitly granted. This breaks the principle of least privilege and collapses the intended separation between group management and user management.
Root Cause
The controller trusts the requesting administrator's add_group permission as sufficient authorization to modify any group's membership. It does not compare the rights carried by the target group against the rights held by the requester. This missing authorization check is a classic instance of improper privilege management under CWE-269.
Attack Vector
Exploitation requires authenticated access with group-management rights and network reachability to the phpMyFAQ administrative interface. The attacker submits a membership update request through the admin panel that adds a controlled account to a pre-existing privileged group. No user interaction is required, and no additional credentials are needed beyond the initial administrator session.
No public proof-of-concept code has been released. Refer to the GitHub Security Advisory for technical details on the vulnerable code path.
Detection Methods for CVE-2026-66399
Indicators of Compromise
- Unexpected membership changes in groups holding edit_user, delete_user, or add_user rights
- Administrator accounts appearing in privileged groups without a corresponding provisioning ticket
- Deletion or password reset of administrator accounts shortly after group membership changes
- Access log entries showing repeated POST requests to the group members endpoint from a single low-privilege admin session
Detection Strategies
- Audit the phpMyFAQ faquser, faqgroup, and faquser_group database tables for recent membership changes and correlate with the acting administrator
- Enable and review phpMyFAQ audit logs for updateMembers actions performed by administrators without user-management rights
- Alert on any group membership change that grants rights the requesting administrator did not previously hold
Monitoring Recommendations
- Forward phpMyFAQ application and web server logs to a centralized logging platform for correlation
- Baseline the set of administrators assigned to user-management groups and alert on deviations
- Monitor for user deletion events immediately following group membership modifications
How to Mitigate CVE-2026-66399
Immediate Actions Required
- Upgrade phpMyFAQ to version 4.1.6 or later on all instances
- Review current group membership and remove any administrators added without authorization
- Rotate credentials for administrator accounts that were exposed to untrusted group managers
- Restrict access to the administrative interface to trusted networks or VPN clients
Patch Information
The vendor addressed the issue in phpMyFAQ 4.1.6 by adding a rights verification check inside GroupController::updateMembers(). Details are published in the GitHub Security Advisory GHSA-28cc-v39j-vr95 and the VulnCheck Advisory.
Workarounds
- Revoke the add_group right from administrators who do not also hold user-management rights until the upgrade is applied
- Remove all rights from unused privileged groups so that inheritance yields no additional permissions
- Place the administrative interface behind an authenticating reverse proxy to limit exposure
# Verify installed phpMyFAQ version and upgrade
grep "VERSION" /var/www/phpmyfaq/version.php
# Download and deploy 4.1.6 or later from the official release
wget https://github.com/thorsten/phpMyFAQ/releases/download/4.1.6/phpMyFAQ-4.1.6.zip
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
